Password managers compared: Bitwarden, 1Password, KeePassXC, Proton Pass and Apple Passwords

A password manager is the most useful security tool most people can install: one strong, unique password per site, filled in only on the real site. The harder question is which one. The five in this comparison follow different designs, from a local encrypted file to a cloud service with family sharing, and each design moves the risk somewhere else. This guide sets out where, so you can choose the trade-off you are comfortable with.

Two designs: cloud sync or a local file

Bitwarden, 1Password, Proton Pass and Apple Passwords encrypt your vault on your device and sync the encrypted copy through the vendor's cloud. The vendor stores data it cannot read, as long as your master password stays secret and the client software is trustworthy. In return for trusting the vendor's servers and update channel, you get sync, sharing and recovery features.

KeePassXC takes the opposite approach. It keeps everything in one encrypted KDBX file on your computer and has no cloud of its own. If you want the file on several devices, you sync it yourself, for example through a cloud folder, and on phones you use third-party apps such as KeePassDX, KeePass2Android, Strongbox or KeePassium. There is no vendor account to breach, but also nobody to help when something goes wrong.

What we compared

We scored each manager on six criteria, and higher is always better. The scores reflect our reading of each vendor's documentation as of October 2026, not laboratory tests.

• Open code and audits: published source code and independent audit reports.
• Passkey support: storing and using passkeys across your devices.
• Sharing for teams: shared vaults, roles and administration.
• Platform coverage: desktop, mobile and browser support.
• Recovery and emergency access: ways back in after a lost password, and access for a trusted person.
• Control over your data: self-hosting or local storage instead of a vendor cloud.

Interactive comparison

Password managers compared

Five password managers scored from 1 to 5 on transparency, passkeys, sharing, platforms, recovery and control; higher is always better.

What matters to you?

Open code and auditsPublished source code and independent audit reports.

Normal

Passkey supportStoring and using passkeys across all your devices.

Normal

Sharing for teamsShared vaults, roles and central administration.

Normal

Platform coverageDesktop, mobile and browser support across operating systems.

Normal

Recovery and emergency accessWays back in after a lost password, and access for a trusted person.

Normal

Control over your dataSelf-hosting or local storage instead of a vendor cloud.

Normal

Reset weights

1. Bitwarden4.5
2. 1Password4.0
3. Proton Pass3.5
4. KeePassXC3.2
5. Apple Passwords2.7

All scores in a table

Criterion	Bitwarden	1Password	Proton Pass	KeePassXC	Apple Passwords
Open code and audits
Passkey support
Sharing for teams
Platform coverage
Recovery and emergency access
Control over your data

Editorial assessment as of 31 October 2026. Scores from 1 to 5, higher is better. Your weights only change the order.

The five candidates, strengths and limits

Bitwarden is open source and publishes its third-party audits, including work by Cure53 and a cryptography review by ETH Zurich that assumed a fully malicious server. It runs on all major platforms, supports passkeys and has a free tier. You can self-host the official server. Vaultwarden is a popular unofficial server written in Rust; it is not associated with Bitwarden, Inc., so you rely on its own maintainers for support and security fixes.

1Password combines your account password with a 128-bit Secret Key stored on your devices, so a stolen copy of the vault cannot be attacked by guessing the password alone. It has polished sharing and administration for families and teams, supports passkeys and publishes the results of independent audits. The apps are not open source, it is paid only, and there is no self-hosting.

KeePassXC is free and open source under the GPLv3. An independent security consultant reviewed it in 2023, and France's national cybersecurity agency ANSSI awarded a 2025 release its CSPN certification. It has supported passkeys through its browser integration since version 2.7.7. There is no official mobile app, sharing means sharing a file, and there is no recovery: lose the master password or key file and the data is gone.

Proton Pass is open source, has been independently audited with a public report and encrypts metadata such as usernames and web addresses as well as passwords. It supports passkeys on all its platforms, has a free tier and is run by Proton in Switzerland. Like the other cloud services, it is only as available as your account, so set up the recovery options before you need them.

Apple Passwords is the app Apple introduced with iOS 18 and macOS Sequoia on top of iCloud Keychain, which Apple encrypts end to end. It is free, handles passkeys and verification codes, and supports shared groups for family and trusted contacts. It is closed source, and Apple's documentation covers Apple devices plus Windows through iCloud for Windows, not Android. That makes it a good default for an all-Apple household and a poor fit for mixed teams.

Passkeys, sharing and recovery

All five store passkeys, so passkey support alone is no longer a reason to pick one over another. What differs is portability. A passkey in Apple Passwords follows your Apple devices; one in a cross-platform manager follows you to Windows, Linux and Android as well. If you might switch managers later, check how the vendor handles moving passkeys to another manager.

For a team, sharing and administration decide the choice. 1Password and Bitwarden offer shared vaults or collections with roles, and Proton Pass offers vault sharing and business plans. Apple's shared groups suit a family. KeePassXC can only share by sharing a database file, which works for two people and breaks down beyond that.

Recovery is the uncomfortable trade-off. With true end-to-end encryption, the vendor cannot reset your vault. Bitwarden offers emergency access for premium users: a trusted contact can request view or takeover access, granted after a waiting period you set. 1Password relies on your Emergency Kit and, in family and business accounts, on recovery by an organiser or administrator. KeePassXC has nothing of the kind.

The LastPass breach of 2022: what it teaches

In August 2022 an attacker reached part of LastPass's development environment through a compromised developer account. Using what was taken, the attacker then targeted another employee, obtained credentials and keys, and copied backups from a cloud storage service, including a backup of customer vault data. LastPass disclosed this in December 2022.

The vaults were not encrypted in full. Usernames, passwords, secure notes and form data were encrypted with AES-256 using a key derived from each master password, but website URLs were stored unencrypted, which alone tells an attacker which services a person uses. A stolen vault can also be attacked offline for as long as the attacker likes, so its safety rests on the master password and the key derivation settings. LastPass named 100,100 iterations of PBKDF2 as its default and advised customers whose settings did not follow its defaults to change the passwords stored in their vaults.

• Choose a manager that encrypts every field, including website addresses and item names.
• Use a long master password, ideally a passphrase of several random words, that you use nowhere else.
• Check your key derivation settings after a migration, because old accounts can keep weak values.
• If your vault provider is breached, change the passwords for your most important accounts, starting with email.

How to choose

If you want open code, every platform and the option to run your own server, Bitwarden fits best. If you manage a family or a small team and value polish, 1Password is strong, provided you accept closed source and a subscription. Proton Pass suits people who already use Proton services or want encrypted metadata with a free tier. Apple Passwords is the low-effort choice for people who only use Apple devices. KeePassXC is for those who want no cloud at all and can manage their own sync and backups.

A stolen vault can be attacked offline for as long as the attacker likes.

Sources and further reading

1. LastPass: Notice of recent security incidentblog.lastpass.com
2. Bitwarden: Is Bitwarden audited?bitwarden.com
3. 1Password security1password.com
4. KeePassXC documentation and FAQkeepassxc.org
5. Proton Pass securityproton.me
6. Apple: Use the Passwords appsupport.apple.com

General information, checked on 31 October 2026. Test changes on one system first and keep a way back. Found something outdated? Tell the editors.